Prepare beta124

[callumalpass]

Summary

Prepare 0.1.0-beta.124. Like #552, this commit only changes the workspace versions, the workspace package versions in both Cargo lockfiles, and MCP's advertised version (the same 19 files), plus one consumer migration note in the changelog. Other changelog entries are already under Unreleased.

Since beta.123:

• SDK wave B (SDK wave B: authority feature discovery, revisioned batch reads, metadata queries and file stat #553): authority feature discovery, revision-bearing batch document reads (readMany uses them when advertised), metadata-only query output and files.stat. Semantic projection format 8 → 9 and hosted query plan 13: derived projections rebuild from exact records, and cursors restart.
• Startup fix (Fix superseded startup assessment cancellation #557): superseded startup-assessment cancellation no longer tears down startup. This lets Writer, Reader and TaskNotes drop their temporary beta.123 patch.
• Hosted attachment links (Fix hosted required links to Reader document attachments #559): hosted required links to ordinary files (Reader documents) validate against committed file metadata. mdbase-rs is pinned to 47890a9d, which brings in Link resolution spec, conformance corpus and opt-in asFile() policies callumalpass/mdbase-rs#103, Rewrite README for mdbase connect users #104 and Stabilize server cold-start test #105.
• Shared private feedback (Share private feedback across mdbase applications #558), mark animations (Animate the mdbase mark for saves, failures, progress and busy work #555, Keep the editor's initial CSS within budget after the mark motions #556), and the Editor focus test fix (editor: wait for person panel focus after authorization return #554).

Consumer canary (from draft #562, run manually): no new regressions against Writer, Reader or TaskNotes. TaskNotes needs a type-only fixture update for the new queryPages overload (noted in the changelog).

Validation

• pnpm version:check passes for v0.1.0-beta.124.
• Hosted exact-commit qualification is required, as always.

Release boundary

This PR creates no tag, public package, client publication, deployment or production authorization.